109 lines
5 KiB
Bash
109 lines
5 KiB
Bash
#!/bin/bash
|
|
# ==============================================================================
|
|
# Wallarm Docker Deployment Bootstrap
|
|
# ==============================================================================
|
|
# Flow: check connectivity → install Docker → download deploy script
|
|
# All under /opt/fw/ — self-contained, user-editable config.
|
|
#
|
|
# curl -fsSL ".../setup.sh" | bash
|
|
# sudo /opt/fw/deploy.sh
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
BOLD='\033[1m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
|
|
REPO="https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main"
|
|
WALLARM_DIR="/opt/fw"
|
|
OFFLINE_DIR="${WALLARM_DIR}/offline"
|
|
|
|
echo -e "${BOLD}Wallarm Bootstrap${NC}"
|
|
|
|
# ── 1. Connectivity check ─────────────────────────────────────────────
|
|
echo -e "${YELLOW}Checking connectivity...${NC}"
|
|
if curl -fsSL --connect-timeout 5 -o /dev/null https://git.sechpoint.app 2>/dev/null; then
|
|
echo -e "${GREEN} git.sechpoint.app reachable${NC}"
|
|
else
|
|
echo -e "${RED} Cannot reach git.sechpoint.app${NC}"
|
|
echo -e "${RED} Check network/firewall. Aborting.${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# ── 2. Ensure curl (for downloads) ────────────────────────────────────
|
|
if ! command -v curl >/dev/null 2>&1; then
|
|
apt-get update -qq 2>/dev/null && apt-get install -y -qq curl 2>/dev/null || true
|
|
fi
|
|
|
|
# ── 3. Ensure Python 3.10+ ────────────────────────────────────────────
|
|
PYTHON_BIN=""
|
|
if command -v python3 >/dev/null 2>&1 && python3 -c "import sys; exit(0 if sys.version_info >= (3,10) else 1)" 2>/dev/null; then
|
|
PYTHON_BIN="python3"
|
|
else
|
|
echo -e "${YELLOW}Installing Python 3...${NC}"
|
|
apt-get update -qq 2>/dev/null && apt-get install -y -qq python3 2>/dev/null || \
|
|
yum install -y -q python3 2>/dev/null || \
|
|
dnf install -y -q python3 2>/dev/null || \
|
|
apk add --no-cache python3 2>/dev/null || true
|
|
PYTHON_BIN="python3"
|
|
fi
|
|
echo -e "${GREEN}Python: $($PYTHON_BIN --version)${NC}"
|
|
|
|
# ── 4. Install Docker under /opt/fw/docker/ ───────────────────────────
|
|
DOCKER_DIR="${WALLARM_DIR}/docker"
|
|
DOCKER_URL="${DOCKER_DOWNLOAD_URL:-https://download.docker.com/linux/static/stable/x86_64/docker-29.2.1.tgz}"
|
|
WALLARM_IMAGE_URL="${WALLARM_IMAGE_URL:-https://git.sechpoint.app/customer-engineering/wallarm/releases/download/v1.0.0/wallarm-node-6.11.0-rc1.tar.gz}"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo -e "${YELLOW}Downloading Docker...${NC}"
|
|
mkdir -p "${DOCKER_DIR}/bin" "${DOCKER_DIR}/data"
|
|
|
|
if [ -f "${OFFLINE_DIR}/docker-29.2.1.tgz" ]; then
|
|
echo -e "${GREEN} Using offline binary${NC}"
|
|
tar -xzf "${OFFLINE_DIR}/docker-29.2.1.tgz" -C "${DOCKER_DIR}/bin/"
|
|
else
|
|
curl -fsSL "${DOCKER_URL}" -o /tmp/docker.tgz 2>/dev/null && \
|
|
tar --strip-components=1 -xzf /tmp/docker.tgz -C "${DOCKER_DIR}/bin/" && \
|
|
rm -f /tmp/docker.tgz
|
|
fi
|
|
|
|
# Start dockerd with custom data root
|
|
if [ -x "${DOCKER_DIR}/bin/dockerd" ]; then
|
|
# Symlink binaries so they're in PATH permanently
|
|
ln -sf "${DOCKER_DIR}/bin/docker" /usr/bin/docker 2>/dev/null
|
|
ln -sf "${DOCKER_DIR}/bin/dockerd" /usr/bin/dockerd 2>/dev/null
|
|
"${DOCKER_DIR}/bin/dockerd" --data-root "${DOCKER_DIR}/data" \
|
|
--exec-root "${DOCKER_DIR}/exec" --pidfile "${DOCKER_DIR}/docker.pid" \
|
|
--userland-proxy=false \
|
|
&>/dev/null &
|
|
sleep 3
|
|
export PATH="${DOCKER_DIR}/bin:$PATH"
|
|
fi
|
|
fi
|
|
|
|
# ── 5. Pre-load Wallarm image if available ────────────────────────────
|
|
if command -v docker >/dev/null 2>&1; then
|
|
if [ -f "${OFFLINE_DIR}/wallarm-node.tar" ]; then
|
|
echo -e "${YELLOW}Loading offline Wallarm image...${NC}"
|
|
docker load -i "${OFFLINE_DIR}/wallarm-node.tar" 2>/dev/null || true
|
|
fi
|
|
fi
|
|
|
|
# ── 6. Download deploy script ─────────────────────────────────────────
|
|
APP_DIR="${WALLARM_DIR}/app"
|
|
mkdir -p "${APP_DIR}"
|
|
echo -e "${YELLOW}Downloading deploy script...${NC}"
|
|
curl -fsSL "${REPO}/sources/python/main.py" -o "${APP_DIR}/main.py"
|
|
curl -fsSL "${REPO}/../deploy.sh" -o "${WALLARM_DIR}/deploy.sh" 2>/dev/null || {
|
|
# Fallback: create wrapper
|
|
cat > "${WALLARM_DIR}/deploy.sh" << 'WRAPPER'
|
|
#!/bin/bash
|
|
exec python3 /opt/fw/app/main.py "$@"
|
|
WRAPPER
|
|
}
|
|
chmod +x "${APP_DIR}/main.py" "${WALLARM_DIR}/deploy.sh"
|
|
|
|
echo
|
|
echo -e "${GREEN}${BOLD}Ready!${NC}"
|
|
echo -e " ${GREEN}sudo /opt/fw/deploy.sh${NC}"
|
|
echo
|
|
echo -e " Config: /opt/fw/app/fw.conf"
|
|
echo -e " Docker: /opt/fw/docker/"
|
|
echo -e " Offline: /opt/fw/offline/ (drop binaries here for air-gapped)"
|